Re: Authenticating maintenance.git

[Maxime Devos <maximedevos@telenet.be>]

[-- Attachment #1: Type: text/plain, Size: 1862 bytes --]

Chris Marusich schreef op wo 23-06-2021 om 18:01 [-0700]:
> Although I was now able to run the pre-push hook, it seems unaware of my
> PGP key.  I tried making the attached change to the README and testing a
> push via "git push -n origin", and it complained about the signature:
> 
> --8<---------------cut here---------------start------------->8---
> $ git push -n origin
> Authenticating commits 8a7e10b to 413b8f1 (1 new commits)...
> [##############################################################################]guix git: error: could not authenticate commit 413b8f1c6d9ca2160d7aa8d80db181a6f39d3d82:
>  key CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D is missing
> error: failed to push some refs to 'git.savannah.gnu.org:/srv/git/guix/maintenance.git'
> --8<---------------cut here---------------end--------------->8---

It is complaining about the missing key, not about signatures.

> GnuPG reports it can find the keys:
> 
> --8<---------------cut here---------------start------------->8---
> $ gpg --list-keys 'CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D'
> [...]

The keyring in ~/.gnupg is irrelevant to "guix git authenticate".
"guix git authenticate" only uses the keys on the keyring branch
(whose fingerprint needs to be .guix-authorizations).

The public key is in .guix-authorization
(see https://git.savannah.gnu.org/cgit/guix/maintenance.git/tree/.guix-authorizations#n32).
But is it on the keyring branch?

It would appear it isn't. There is a marusich-D822469D.key, but
that appears to be a different key (DD40 9A15 D822 469D).
Perhaps you need to add your key to the keyring branch?
IIUC, commits to the keyring branch are unauthenticated, so
you could do that yourself. (It is secure because .guix-authorizations
contains a whitelist of allowed key fingerprints.)

Greetings,
Maxime.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]